CVE Vulnerability Catalog

Several psqlODBC entry points use an application-supplied column number or row index as an array index without validating it. SQLBindCol with a column number above 32767 wraps the binding count negative, a negative SQL_DESC_COUNT unbinds columns at negative indexes, and SQLSetPos(SQL_ADD) does not check the row number against the rowset size.

psqlODBC contains a stack buffer overflow when quoting schema or table names into a 128-byte stack buffer. The length check allows writing up to two bytes past the end of the buffer for long names originating from the application's SQL text or from a server-supplied column name. Versions before psqlODBC 18.00.0006 are affected.

SQLSpecialColumns in psqlODBC splices the received table and schema names into its catalog query without escaping them, while other catalog functions escape them. An application passing an untrusted table or schema name to SQLSpecialColumns lets the caller execute arbitrary SQL with the connection's privileges.

The psqlODBC parser for ODBC escape sequences in application SQL text writes the argument offsets of a {fn} escape into a fixed 16-entry stack array without bounds checking and without initialization. An escape with too many arguments overflows the stack, a reference to an unsupplied argument copies arbitrary bytes into the query, and copying a {d}, {t}, {ts}, or {escape} body writes one byte past a 128-byte stack buffer.

psqlODBC trusts server-supplied counts and lengths in three places: SQLBulkOperations can underflow a size subtraction, SQLStatistics iterates index keys without bounding to fixed storage, and bytea octal decoding reads up to two bytes past a truncated escape sequence. A server not trusted under current SSL settings can crash the client or cause out-of-bounds reads. Versions before psqlODBC 18.00.0006 are affected.

In psqlODBC, the server-reported name of an auto-increment int4 column is placed into a printf-style format string and later expanded while building the WHERE clause for an updatable cursor. A column name containing format directives causes reads of unrelated memory, potentially crashing the application or copying client memory into query text sent to the server. Versions before psqlODBC 18.00.0006 are affected.

psqlODBC sizes its row cache from the column count of a cursor's first result but recomputes the column count from each later FETCH reply without checking that it matches. A server not trusted under current SSL settings can answer a later FETCH with more columns and make the driver write tuple records past the end of the heap allocation; a keyset reply with fewer columns than the key fields underflows the unsigned field count. This is reachable with UseDeclareFetch enabled.

psqlODBC copies the reply to a large-object read (loread) into the application's buffer using the length sent by the server, without comparing it to the buffer size. A server not trusted under current SSL settings, or a man-in-the-middle, can return more bytes than the buffer holds and overwrite adjacent memory in the client process with server-chosen bytes. Fetching any large-object column is sufficient to trigger it.

Attendo (formerly Petpooja Payroll) Admin Android application version 3.0.13 and earlier contains hard-coded credentials that can be extracted by decompiling bundled Flutter configuration assets such as production.json. The recovered credentials allow authentication to the production MQTT broker over TCP 1883, access to topics containing employee attendance records, personal identifiers, Base64-encoded photographs, device telemetry, and authentication material, and publishing messages to those topics.

Munshi (by Petpooja) before 2026-07-13 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious markup through item descriptions or messages in the Purchase Inquiry thread. The payload is assigned to innerHTML during rendering before text cleaning completes, enabling JavaScript execution in the browser of another user who opens the thread.

Munshi (by Petpooja) before 2026-06-17 contains a broken object level authorization vulnerability that allows authenticated attackers to access another user's purchase inquiry by manipulating the thread identifier in the GET /purchase-inquiry/thread/{thread-id} endpoint. Attackers can read supplier communication and quotation content belonging to other users.

Munshi (by Petpooja) before 2026-07-07 contained a missing authorization vulnerability in its company deletion workflow at DELETE /api/companies/{company_id}, where the application fails to enforce the dedicated company_delete permission or verify company ownership. An authenticated invited sub-user with mere access to a company can perform a hard delete of the company record.

Munshi (by Petpooja) before 2026-07-28 contains a broken object level authorization vulnerability that allows authenticated sub-users to delete invoices belonging to the tenant owner via the DELETE /api/invoice/{invoice_id} and POST /api/invoices/bulk-delete endpoints. The endpoints only verify tenant membership without enforcing object-level ownership or permission checks.

Munshi (by Petpooja) before 2026-06-30 contained a payment bypass vulnerability in its subscription payment webhook at POST /api/payment/order/webhook, which lacks webhook authentication, cryptographic signature verification, source validation, and independent server-side confirmation with the payment provider. A remote, unauthenticated attacker can submit a forged payment-success notification referencing an order obtained from the payment-status redirect URL, causing the backend to mark the subscription as paid/active and granting paid access without an actual successful payment.

GleezCMS v1.2.0 contains a directory traversal vulnerability in the action_serve function in media.php. A remote attacker can exploit it to obtain sensitive information.

An integer truncation vulnerability in the NAS decoder of OpenAirInterface (OAI) CN5G AMF v2.2.1 allows an unauthenticated remote attacker to cause a denial of service (DoS) via crafted NAS Registration Requests containing a malformed IMEISV in the 5GS Mobile Identity IE. The Type6NasIe::Validate() function truncates a 32-bit length value to 16 bits, bypassing length validation and causing an out-of-bounds heap read in DecodeImeisv(), which can crash the AMF process.

The Joomla Custom Tables extension before 3.7.8 allows an unauthenticated attacker to upload a polyglot file with an attacker-controlled extension to the web-accessible tmp directory. The stored path is disclosed in the response, and the file is served as static content by default.

The Joomla DJ-Classifieds extension before 3.11.3 contains an IDOR vulnerability in the "duplicate my ad" feature of the new-ad form. An advert is loaded by its raw numeric ID without verifying that it belongs to the requesting user or whether it is published, blocked, or a pending draft, allowing any logged-in user to retrieve the full content of another user's ad, including contact details and price.

The Joomla DJ-Classifieds extension before 3.11.3 is vulnerable to an unauthenticated SQL injection in the frontend search.

The Joomla DJ-Classifieds extension before 3.11.3 is vulnerable to an unprivileged file upload, leading to full remote code execution (RCE).